CVE-2026-25541

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25541
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25541.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25541
Aliases
Downstream
Related
Published
2026-02-04T22:03:53.554Z
Modified
2026-02-09T02:50:22.610538Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Bytes is vulnerable to integer overflow in BytesMut::reserve
Details

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity >= newcap + offset" uses an unchecked addition. When newcap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as sparecapacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Database specific 
{
    "cwe_ids": [
        "CWE-680"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25541.json"
}
References

Affected packages

Git / github.com/tokio-rs/bytes

Affected ranges

Type
GIT
Repo
https://github.com/tokio-rs/bytes
Events
Introduced
b7249149a926f0d5f9f89897853eb7dc7506d27b
Fixed
417dccdeff249e0c011327de7d92e0d6fbe7cc43

Affected versions

v1.*
v1.10.0
v1.10.1
v1.11.0
v1.2.1
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25541.json"